Hellwarp

We started getting the following Application Events on our Trend OfficeScan servers, mixed 2003 and 2008

Event Fault:

EVENT LOG Application
EVENT TYPE Warning
SOURCE Trend OfficeScan Server
CATEGORY System
EVENT ID 900
USERNAME NT AUTHORITY\SYSTEM
COMPUTERNAME BIMJHBFP
DATE / TIME 2/20/2012 6:23:17 AM
MESSAGE Error Message: The digital signature of the following file is invalid. OfficeScan server has renamed the file to prevent OfficeScan file danamge.
C:\Program Files\Trend Micro\OfficeScan\PCCSRV\pccnt\COMMON\DWIoTrapNT.dll

RESOLUTION: [From Trend Micro]
Short:

As a workaround for this issue , you may disable check of digital signature on the files on the officescan server.

1. Set “CheckDigitalSignatureForHotfix” to ‘0’ in …\PCCSRV\ofcscan.ini
2. Stop OfficeScan Master Service
3. Rename “DWIoTrapNT.dll_Invalid” to “DWIoTrapNT.dll”
4. Start OfficeScan Master Service

Full:
This message is to inform you that the solution for Service Request ID 1-365450963 has been delivered.

SR Solution: Officescan server is designed to enumerate client files (a pre-defined list hardcoded in codes) and check digital signatures of the files and if any file has invalid digital signature or no digital signature, it will Rename/move the corrupt files.

The reported issue is caused by 10.6 GM DWIoTrapNT.dll’s digital signature is invalid. The Code signing certificate for this file expired on 16/02/2012 . Hence Officescan server renames it to *._invalid.

The issue is currently being handled by the product developement team and will be fixed by a hotfix to be released soon.

ETA for the related hotfix is 29-Feb , 2012

As a workaround for this issue , you may disable check of digital signature on the files on the officescan server.

Once the hotfix is available and installed , you may enable the above feature again.

HOW I SPEAK ENGLISH IN MY HEAD

“Let me introduce myself. I am Sir Derp Derpington. It is a pleasure to meet you.”

HOW I REALLY SPEAK ENGLISH

“Me name is Potato”

Log Name: Application
Source: MSExchange ADAccess
Event ID: 2937
Level: Warning

Process mmc.exe (PID=10956). Object [CN=Marlene abcd,OU=Users,OU=JHB Depot,DC= abcd,DC=CO,DC=ZA]. Property [HomeMTA] is set to value [ abcd.CO.ZA/Configuration/Deleted Objects/Microsoft MTA
DEL:715951fa-c077-41e4-b2e9-3905302b91b4], it is pointing to the Deleted Objects container in Active Directory. This property should be fixed as soon as possible.

I’ve also see the following Processes
EdgeTransport.exe
powershell.exe
w3wp.exe

To Fix:

Get-Mailbox -Identity “Username” | Update-Recipient

PowerTip of the Day, from PowerShell.com:

WMI is a great information resource, and Get-WmiObject makes it easy to retrieve WMI instances. First, use -List parameter to find WMI class names. For example, find classes that deal with network:

Get-WmiObject-ListWin32_*network*

Next, pick one of the classes and enumerate its instances:

Get-WmiObjectWin32_NetworkAdapterConfiguration

With WQL, a SQL-type query language for WMI, you can even create more sophisticated queries, such as:

Get-WmiObject-Query‘Select * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=True’

Some common Cocktails with alcoholic ingredients on how to mix the cocktails and summary of the mixing proportion

Powershell V2.0 is the current latest realease [Dec 2011], installed by default on Windows 7 and Windows Server 2008 R2; and also available for download for earlier versions of Windows both 32bit and 64bit platforms.

On Windows 7, click the Start icon, All Programs, Accessories, “Windows PowerShell” folder
or Winkey+R type Powershell and enter

Windows Powershell is basically a CLI [Command Line Interface] like cmd but much more advanced

So Powershell is a task automation framework, cosisting of a command-line shell and associated scripting language built on top of, and integrated with the .NET Framework. PowerShell provides full access to COM and WMI, enabling administrators to perform administrative tasks on both local and remote Windows systems.

In PowerShell, administrative tasks are generally performed by cmdlets (pronounced command-lets), specialized .NET classes implementing a particular operation. Sets of cmdlets may be combined together in scripts, executables (which are standalone applications), or by instantiating regular .NET classes (or WMI/COM Objects). These work by accessing data in different data stores, like the filesystem or registry, which are made available to the PowerShell runtime via Windows PowerShell providers.

Windows PowerShell also provides a hosting mechanism with which the Windows PowerShell runtime can be embedded inside other applications. These applications then leverage Windows PowerShell functionality to implement certain operations, including those exposed via the graphical interface. This capability has been utilized by Microsoft Exchange Server 2007 to expose its management functionality as PowerShell cmdlets and providers and implement the graphical management tools as PowerShell hosts which invoke the necessary cmdlets. Other Microsoft applications including Microsoft SQL Server 2008 also expose their management interface via PowerShell cmdlets. With PowerShell, graphical interface-based management applications on Windows are layered on top of Windows PowerShell. A PowerShell scripting interface for Windows products is mandated by the Common Engineering Criteria.

PowerTip of the Day, from PowerShell.com:

Out-GridView is a great way to present results in a “mini-Excel” sheet:

Get-Process|Out-GridView

However, Out-GridView has two requirements:.NET Framework 3.5.1 and the built-in script editor ISE must both be installed. ISE is not installed by default on Windows Servers. So, if you want to use Out-GridView on server products, you will need to make sure you install the ISE feature.

On a Server 2008 R2, you could enable ISE by using PowerShell:

Import-ModuleServerManager

Add-WindowsFeaturePowerShell-ISE

Pocket Tazer Stun Gun, a great gift for the wife.

A guy who purchased his lovely wife a pocket Tazer for their anniversary submitted this:

Last weekend I saw something at Larry’s Pistol & Pawn Shop that sparked my interest.. The occasion was our 15th anniversary and I was looking for a little something extra for my wife Julie. What I came across was a 100,000-volt, pocket/purse-sized Tazer.

The effects of the Tazer were supposed to be short lived, with no long term adverse affect on your assailant, allowing her adequate time to retreat to safety…??

WAY TOO COOL! Long story short, I bought the device and brought it home… I loaded two AAA batteries in the darn thing and pushed the button.. Nothing! I was disappointed. I learned, however, that if I pushed the button and pressed it against a metal surface at the same time, I’d get the blue arc of electricity darting back and forth between the prongs.

AWESOME!!! Unfortunately, I have yet to explain to Julie what that burn spot is on the face of her microwave.

Okay, so I was home alone with this new toy, thinking to myself that it couldn’t be all that bad with only two AAA batteries, right?

There I sat in my recliner, my cat Gracie looking on intently (trusting little soul) while I was reading the directions and thinking that I really needed to try this thing out on a flesh & blood moving target.

I must admit I thought about zapping Gracie (for a fraction of a second) and then thought better of it. She is such a sweet cat. But, if I was going to give this thing to my wife to protect herself against a mugger, I did want some assurance that it would work as advertised.

Am I wrong?

So, there I sat in a pair of shorts and a tank top with my reading glasses perched delicately on the bridge of my nose, directions in one hand, and Tazer in another.

The directions said that:

a one-second burst would shock and disorient your assailant;

a two-second burst was supposed to cause muscle spasms and a major loss of bodily control; and

a three-second burst would purportedly make your assailant flop on the ground like a fish out of water.

Any burst longer than three seconds would be wasting the batteries.

All the while I’m looking at this little device measuring about 5″ long, less than 3/4 inch in circumference (loaded with two itsy, bitsy AAA batteries); pretty cute really, and thinking to myself, ‘no possible way!’

What happened next is almost beyond description, but I’ll do my best.

I’m sitting there alone, Gracie looking on with her head cocked to one side so as to say, ‘Don’t do it stupid,’ reasoning that a one second burst from such a tiny lil ole thing couldn’t hurt all that bad.. I decided to give myself a one second burst just for heck of it.

I touched the prongs to my naked thigh, pushed the button, and…

HOLY MOTHER OF GOD. WEAPONS OF MASS DESTRUCTION. WHAT THE… !!!

I’m pretty sure Hulk Hogan ran in through the side door, picked me up in the recliner, then body slammed us both on the carpet, over and over and over again. I vaguely recall waking up on my side in the fetal position, with tears in my eyes, body soaking wet, both nipples on fire, testicles nowhere to be found, with my left arm tucked under my body in the oddest position, and tingling in my legs! The cat was making meowing sounds I had never heard before, clinging to a picture frame hanging above the fireplace, obviously in an attempt to avoid getting slammed by my body flopping all over the living room.

Note:
If you ever feel compelled to ‘mug’ yourself with a Tazer,
one note of caution:

There is NO such thing as a one second burst when you zap yourself! You will not let go of that thing until it is dislodged from your hand by a violent thrashing about on the floor!
A three second burst would be considered conservative!

A minute or so later (I can’t be sure, as time was a relative thing at that point), I collected my wits (what little I had left), sat up and surveyed the landscape.

My bent reading glasses were on the mantel of the fireplace.
The recliner was upside down and about 8 feet or so from where it originally was.
My triceps, right thigh and both nipples were still twitching.
My face felt like it had been shot up with Novocain, and my bottom lip weighed 88 lbs.
I had no control over the drooling.
Apparently I had crapped in my shorts, but was too numb to know for sure, and my sense of smell was gone.
I saw a faint smoke cloud above my head, which I believe came from my hair.

I’m still looking for my testicles and I’m offering a significant reward for their safe return!

PS: My wife can’t stop laughing about my experience, loved the gift and now regularly threatens me with it!

If you think education is difficult, try being stupid!!!!

If you are trying to connect to a Sharepoint document library via UNC path and receive the following error

No network provider accepted the give network path

You are probably trying to connect via Windows 2003

You need to change the Startup Type and start the WebClient Service on the server.

Also, you will need to follow the these instructions from Microsoft Technet.

http://support.microsoft.com/?kbid=841215

PowerTip of the Day, from PowerShell.com:

By using PowerShell WMI, you can enumerate the start mode that you want your services to use. To get a list of all services, try this:

Get-WMIObjectWin32_Service|Select-ObjectName, StartMode

If you want to find out the start mode of one specific service, try this instead:

([wmi]‘Win32_Service.Name=”Spooler”‘).StartMode

Trend OfficeScan The digital signature of the following file is invalid

English in my Head

Event 2937 MSExchange ADAcces

Use WMI and WQL!

PowerTip of the Day, from PowerShell.com:

Popular Cocktail Poster

what is powershell

Use Out-GridView Requirements

PowerTip of the Day, from PowerShell.com:

Pocket Tazer Stun Gun, a great gift for the wife

Connecting to SharePoint Document Library through UNC Path

Determining Service Start Modes

PowerTip of the Day, from PowerShell.com:

Meta

Hellwarp

Hellwarp

PowerTip of the Day, from PowerShell.com:

PowerTip of the Day, from PowerShell.com:

PowerTip of the Day, from PowerShell.com:

Meta

Tag Cloud